Security

How to find the last login over an IP's client range

arkonner
Path Finder

I am using the search below to find the last login over a subnet in a 24hr range. Using the "dedup Account_Name" if the same Account_Name perform a login over more than one IP I will receive only one result. I am looking to find all last login over the entire range of ip address (src_ip)

Thank you in advance

index="main" Source_Network_Address="10.3.140.*" EventCode=4624 Account_Name="*" AND Account_Name !=CZ* AND Account_Name !=5* AND Account_Name !=CN* AND Account_Name !=ANONYMOUS* AND Security_ID="*" | dedup Account_Name | table Account_Name  Security_ID src_ip _time
Tags (2)
0 Karma

DalJeanis
Legend

When posting code, be sure to mark it as code so that the system doesn't read an asterisk as a formatting command, and doesn't delete items in angle brackets as bad html. I've fixed that for you.

There are various ways - highlight the code and hit the code button (101 010), or put grave accents (`) before and after the entire chunk of code, or indent each line by at least four spaces. There's also a function key, IIRC.

0 Karma

sundareshr
Legend

Try this

index="main" Source_Network_Address="10.3.140." EventCode=4624 Account_Name="" AND Account_Name !=CZ* AND Account_Name !=5* AND Account_Name !=CN* AND Account_Name !=ANONYMOUS* AND Security_ID="*" | stats latest(Account_Name) latest(Security_ID) by src_ip _time
0 Karma

DalJeanis
Legend

@sundareshr - There were some asterisks missing from the original code, please see the updated post.

0 Karma

arkonner
Path Finder

alt text

The result is reported below - The account_name is not reported and there is a duplication of events instead of only the last one

0 Karma

jclehmuth
Path Finder

sundareshr search worked, minus the small error...
| stats latest(_time) as Time latest(Account_Name) latest(Security_ID) by src_ip | fieldformat Time=strftime(Time, "%m/%m/%Y %H:%M:%S")

should be | stats latest(_time) as Time latest(Account_Name) latest(Security_ID) by src_ip | fieldformat Time=strftime(Time, "%m/%d/%Y %H:%M:%S")

0 Karma

arkonner
Path Finder

Hi,

I did the change but the result is almost the samealt text

0 Karma

sundareshr
Legend

The reason Account_Name is not reported is because you have a Account_Name="" in your search. Remove that. Also, make this change `.... | stats latest(_time) as Time latest(Account_Name) latest(Security_ID) by src_ip | fieldformat Time=strftime(Time, "%m/%m/%Y %H:%M:%S")

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...